You sign up for GPU capacity expecting one company on the other side. Then you notice the name on the invoice, the name on the title schedule and the name on the loan documents are three different legal persons. This is how GPU capacity is financed. “Who actually owns the GPUs” is a question of continuity: whose balance sheet carries the risk, and whether your checkpoints survive a refinancing.
We trace it in three moves: the balance sheet you can see, the title chain you cannot, and your position inside it. By the end you will hold three questions to ask before signing. Start with who owns the hardware behind your invoice and the bond-yield signal that started the enquiry.
What are off-balance-sheet commitments, and why do they take hyperscaler obligations from roughly $800B to $3.5T?
Off-balance-sheet commitments are obligations (operating leases, purchase commitments and guarantees) that behave like debt without being presented as debt. Once counted, UBS takes aggregate hyperscaler obligations from roughly $800 billion of disclosed debt to $3.5 trillion, a figure corroborated by Brookings, which cites a Wall Street Journal analysis putting the total near $3 trillion.
The gap is larger than the reported figure, which is why a provider’s stated debt number is only a starting point. Operating lease liabilities are future rent, recognised only in part. Purchase commitments are orders for chips and capacity that will become leases later. Guarantees sit off the page until called.
The gap is built in by design: if a vehicle buys the hardware and the operator leases it, the operator books a lease obligation while the debt sits in the vehicle. The economics are unchanged even though the presentation differs. The take-or-pay contract is what makes this financeable: it converts uncertain utilisation into scheduled cash flow a lender can underwrite, while the obligation sits off the balance sheet. That raises the question the next section answers: who actually holds title to the chips.
Where to look? The lease footnote, the purchase commitment note, guarantees and contingencies, and the “contractual obligations” table in a 10-K or 20-F. CoreWeave shows the pattern at small scale: $35.6 billion of debt against $16.3 billion of operating lease liabilities, plus $35.5 billion more in unstarted leases. The hyperscalers do the same at far larger scale.
Microsoft is the anchor offtaker whose credit makes these structures financeable, and the customer that left Nscale’s Loughton site before listing. The chain runs upward past the lender: NVIDIA holds $6.3 billion of unsold-capacity guarantees through 2032 and a $500 billion financing-platform programme. Backstops move the commitment up the chain.
What is a special-purpose vehicle, and who actually owns the GPUs you are renting through one?
A special-purpose vehicle (SPV) is a bankruptcy-remote entity that holds the GPUs and the debt against them, isolated from the operator’s other creditors. When you rent through one, the SPV, not the company on your invoice, usually owns the chips, owes the loan and leases capacity onward.
Bankruptcy remoteness is the point. If the operator fails, the vehicle’s assets are insulated from its other creditors, so the lender keeps enforcing. You benefit indirectly: capacity keeps running, though you get no claim on the chips.
The diagnostic is three questions, and it applies to any compute deal. Which legal entity signs? Which holds title? Which owes the debt? If the answers differ, you are contracting with a structure. The layers run bottom to top: equity at the bottom, senior debt above it, the vehicle that holds title and owes the loan above that, then the operator that leases the capacity and signs your contract. The guarantee sits near the top, backing the senior layer rather than the renter.
Take the roughly $35 billion structure Apollo and Blackstone built for Anthropic. The money funded a vehicle that bought around a million of Google’s TPUs and leased them to Anthropic; Broadcom supports the senior notes, Google backstops the site leases, and the operating company never held the hardware or the debt. Anthropic added a gigawatt-scale compute deployment without adding a dollar of debt; its lack of a rating meant third-party support was needed for investment grade.
None of this is a distress signal: Meta’s Hyperion SPV raised $27 billion of A+ debt, with PIMCO holding roughly $18 billion. Magnetar’s 2021 convertible into CoreWeave became a stake worth roughly $12.5 billion, and CoreWeave’s delayed-draw term loan (DDTL) series is the closest thing to a public term structure for GPU credit. The one risk it cannot design away is project-on-project: financed chips cannot earn if the site loses power.
And your prepayment sits at the bottom of this same structure. The capital stack in full and what the chips inside the vehicle are worth are covered next.
How does a customer prepayment become the first-loss cushion in a GPU financing structure?
Cash paid before service is delivered functions as equity in the lender’s model: it absorbs first loss on the facility, which is why lenders price off the prepayment ratio in a take-or-pay contract. That is why it is called the first-loss cushion, and why your creditworthiness is being underwritten as part of the deal.
The differential is the price of not being investment grade: CoreWeave’s investment-grade offtakers prepay 15-25% at signing on take-or-pay contracts covering roughly 96% of revenue, unrated borrowers face 25-30%, and some smaller GPU-cloud operators, or neoclouds, have demanded up to 100% when shorter-dated rentals were scarce.
A prepayment is an unsecured loan to the operator, repaid in service. Once you see it that way, asking for protection feels standard rather than adversarial. In market practice, roughly 10-15% for a short reservation against a rated counterparty is the going rate, rising to 15-25% only where the buyer’s own credit strength is being used to support the facility and the contract reflects it.
In exchange, ask for protection at the level of principle: escrow of the prepaid amount, step-in or transition rights, a refund on failure, and a reduction in the prepayment as the facility amortises. The tell shows on the balance sheet: prepayment appears as deferred revenue or remaining performance obligations, a liability that functions as an equity tranche in all but name. The protections you ask for in return are what a prepayment should buy you in the contract, covered in its own article.
Three questions before you sign
The question “who actually owns the GPUs” resolves into a habit: before you sign, work out which legal person you are dealing with, and where your own prepayment ranks. Your contract is a position inside a financing structure.
Read the lease footnote, the purchase-commitment note and the prepayment clause as a lender reads a term sheet. Because a prepayment is first-loss credit support, asking for those protections in the contract is standard diligence. Whether your checkpoints survive is a function of someone else’s refinancing. Now you know where to look before you sign.
Frequently Asked Questions
Is my GPU cloud provider just a shell company with a lease?
No. A shell company exists to hold assets and nothing else, while a GPU special purpose vehicle exists to hold assets and debt on defined terms, with independent directors, its own accounts and a lender holding a perfected security interest. The structure is disclosed and deliberately financed. The real risk is not the word shell, it is not knowing which of the legal persons you actually signed with.
Who does bankruptcy remoteness actually protect, me or the lender?
The lender, primarily. Remoteness keeps the vehicle’s GPUs out of the operator’s insolvency, so the collateral is not pooled with other creditors and the loan keeps performing. Renters benefit indirectly, because capacity keeps running while the vehicle is serviced. It gives you no claim on the chips, though, and it can work against you the moment the lender enforces its security.
What is a take-or-pay contract, and why does every GPU deal seem to need one?
You pay for reserved capacity whether or not you use it. For a lender, that converts uncertain utilisation into scheduled cash flow, which is what makes a loan against rapidly depreciating hardware underwriteable at all. That is why the contract sits at the centre of the financing, and why the offtaker’s credit, not the chips, is what gets priced.
How do I find out which legal entity actually owns the chips I am renting?
Ask for three things in writing: the legal name and registration number of the contracting entity, the entity named as owner on the hardware invoice or title schedule, and the lender’s security registration. In Australia you can search the PPSR; in the United States, UCC-1 filings. If the three names differ, you are contracting with a structure. Get your serial numbers into the schedule.
If my GPU provider fails, do I get to keep the GPUs?
No. Title sits with the vehicle or its lender, and your agreement is almost always a service contract rather than a lease of the hardware. On default you are an unsecured creditor for undelivered service, ranked behind the secured lender, with whatever step-in or transition rights your contract happens to contain. Most contracts contain none unless you negotiated them in.
What happens to my data and checkpoints if the provider goes under?
It depends on where the data sits and who controls it. Checkpoints on the provider’s storage form part of its estate and can be frozen while a lender or administrator takes control. The practical answer is architectural: replicate weights and checkpoints to storage you control, hold credentials in your own tenancy, and test a restore from outside the provider before you need one.
Does NVIDIA’s backstop protect me if my provider fails?
No. Vendor support, whether NVIDIA’s unsold-capacity guarantees or Broadcom supporting senior notes, protects the lender’s downside on specific paper. It relocates risk rather than removing it, and it runs to the financing parties. Nothing in it gives a renter a claim, a refund or priority, so your protection has to come from your own contract terms and your own architecture.
Is a provider that owns its own GPUs safer than one using an SPV?
Not automatically. Ownership on the operator’s own balance sheet means your counterparty and the asset owner are the same legal person, which is simpler. It also means the chips are exposed to every other claim on that company. An SPV gives you a cleaner asset but a more distant counterparty. Leverage, amortisation and your contractual rights matter more than the label.
Do AWS and Azure own the GPUs they rent me?
Yes, in the ordinary case. Hyperscalers buy hardware on their own balance sheets and rent capacity as a service, so the entity on your invoice and the owner of the chips are the same. That simplicity is part of what you pay a premium for. It does not remove risk; it concentrates it in one very large, highly rated counterparty.
Does buying the GPUs outright avoid this exposure?
It changes the exposure rather than removing it. You own the asset, so nobody else’s refinancing can take it away, but you carry the residual value risk yourself and fund the entire purchase up front. Over a three year training programme the question becomes whether you can redeploy or resell the hardware, which is the same residual value question the lender is underwriting.
Why are GPUs financed separately from the data centre that houses them?
They have different useful lives and different collateral. A shell and its power infrastructure last decades and are financed as property; GPUs depreciate in three to five years and are financed against contracted cash flow. Separating them lets each lender take security over what it understands. The cost is project-on-project risk: perfectly financed chips that cannot earn if the site loses power.
